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Abstract 

A new relativistic quantum protocol is proposed allowing to implement the bit commitment 
scheme. The protocol is based on the idea that in the relativistic case the field propagation to the 
region of space accessible to measurement requires, contrary to the non-relativistic case, a finite 
non-zero time which depends on the structure of the particular state of the field. In principle, the 
secret bit can be stored for arbitrarily long time with the probability arbitrarily close to unit. 
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^ ! 1 Introduction 

, The bit commitment scheme includes two distant users A and B and can be described as follows [1]. 

I At the time moment to user A choses one bit (0 or 1) and then sends to user B only partial information 
T-H ' on that bit so that this information is not sufficient to find out which bit was actually chosen by user 
^ ■ A. At the second (commitment) stage user B can ask A to send him the rest information on the bit. 
ly-^ i The protocol should provide guarantees to user B that at the second stage user A did not change his 

' mind on the bit chosen at to, so that user A cannot cheat. 

■ The classical bit commitment schemes when A and B can only exchange information through 
Q>^ , the classical channel are based on the unproven computational complexity of e.g. discrete logarithm 
On I problem. The schemes which employ a quantum information channel in addition to the classical one 

' are called quantum bit commitment schemes. In that case information is carried by quantum states. 

Earlier various quantum bit commitment protocol have been proposed [2~4]. However, later the 
I impossibility of the ideal non-relativistic quantum bit commitment protocol was proved since user A 

■ can always cheat user B by employing the EPR-pairs and delaying his measurement (actually delaying 
^ . his choice of the bit) until the second stage of the protocol [5,6]. 

, Recently, a bit commitment protocol was proposed which takes into account the finite speed of 

' signal (information) propagation [7,8]. This relativistic classical protocol is unconditionally secure (its 
^ ■ security is based on the fundamental laws of nature only) and allows to delay the second stage of the 
protocol (i.e. to store the information on the secret bit chosen by user A) for arbitrarily long time, 
although it requires that the two parties A and B each have a couple of spatially separated sites fully 
controlled by them 

Below we propose a relativistic quantum protocol allowing to realize the bit commitment scheme 
during a finite time interval. To be more precise, in the indicated protocol the user B cannot determine 
the bit chosen by user A employing the information sent to him by user A during a finite time tc (in 
other words, the probability of correct bit identification during arbitrarily large but finite chosen in 
advance time interval tc does not exceed the probability of correct guessing of that bit, i.e. 1/2, by 
arbitrarily small chosen beforehand quantity e). On the other hand, user B can ask user A at any 
time t < tc which bit he had actually chosen and later at any moment T > tc h.e can check which 
bit was chosen by user A at to- It should be noted that actually the finite time tc is also present in 
the classical bit commitment protocols based on computational complexity of various problems where 
it is determined by the computational resources available for user B and should therefore be selected 
in such a way that the identification of the chosen bit from the information disclosed by user A is 
impossible in a time interval shorter than tc- In our protocol the impossibility of identification of 
the secret bit in a time interval shorter than tc is based on the fundamental laws of nature (like in 
the classical relativistic protocol [7,8]) rather than the advances in technology available for user B; 
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however, employment of the quantum states (to be more precise, single-particle quantum field states) 
as the information carriers allows to construct a protocol where each user controls a single site. In 
addition, in contrast to the non-relativistic quantum mechanics, the constraint on the maximum speed 
of information transfer allows to develop a secure protocol based on the orthogonal states. 

The paper is organized as follows. Section 2 deals with quantum-mechanical measurements em- 
ployed in the protocol; a simple model one- dimensional measurement is described in Section 3. The 
protocol itself is given in Section 4. 

2 Quantum-mechanical measurements used in the protocol 

All quantum cryptographic protocols actually employ the following two features of quantum theory. 
The first one is the no cloning theorem [16], i.e. the impossibility of copying of an arbitrary quantum 
state which is not known beforehand or, in other words, the impossibility of the following process: 



where \A) and \B^) are the apparatus states before and copying act, respectively, and C/ is a unitary 
operator. Such a process is prohibited by the linearity and unitary nature of quantum evolution. 
Actually, even a weaker process of obtaining any information about one of the two non-orthogonal 
states without disturbing it is impossible, i.e. the final states of the apparatus \A^^) and l^^j) 
corresponding to the initial input states IV^i) and IV'2), respectively, after the unitary evolution U, 



can only be different, \A^^) 7^ |^i/'2)' (V'ilV'2) 7^ [10], which means the impossibility of reliable 
distinguishing between non-orthogonal states. There is no such a restriction for orthogonal states. 
That is why almost all cryptographic protocols employ non-orthogonal states as information carriers, 
the only exception being the protocol suggested in Ref.[ll]. 

In quantum mechanics any two orthogonal states can be reliably distinguished, and within the 
framework of the non-relativistic theory this can be done instantly. At the present time there is every 
ground to believe that in the relativistic quantum theory the orthogonal quantum states can also be 
reliably distinguished without disturbing them. However, the existence of a finite maximum speed 
of the information transfer and field propagation imposes a restriction on the time required for this 
process: two orthogonal states can only be reliably distinguished during a finite non-zero time interval 
whose duration depends on the structure of the states. The reason is that such measurements are 
actually non-local, as explained below. 

Consider first the non-relativistic case. Suppose we are given two orthogonal states of a one- 
dimensional non-relativistic particle \tpi) and IV'2), 



\A)\^p)^u{\A)m = \B^)\m) 



|^)|Vi)^^(|^)|V^i)) = |A^,)|^i) 



1^)1^2) -C/(|A)|V'2)) = |^^.)|V2), 



(V'ilV'2) = 0. 



(1) 



In the momentum realization of the Hilbert space we have 




(2) 



Let the wavefunctions IV'1,2) have non-overlapping supports 



supp tpiip) f] supp V'2(p) = 0- 



(3) 
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The orthogonality of the states is generally a non-local property in the sense that the scalar product 
involves the values of the wavcfunctions at all points in the space. If the states are orthogonal in 
the entire space, their projections on a particular subspace should not necessarily be orthogonal. To 
illustrate this point, consider the same states in the position realization of the Hilbert space of states: 

/oo roo 
iji,2{x)\x)dx, ^i,2(x) = / e^^'^Vi,2(p)dp. (4) 
-oo J —oo 

Generally, the orthogonality is only preserved in the entire space and the same states restricted to a 
certain subspace should not be necessarily orthogonal: 

(V'i|V'2)=/ ri{x)Mx)dx ^ 0, if J^(x)7^(-oo,oo). (5) 
Jn{x) 

Reliable distinguishing of the two states generally requires the access to the entire region of space 
where these states are present. Non-relativistic quantum mechanics allows instantaneous access to 
the entire coordinate space, that is it allows instantaneous non-local measurements. To be more pre- 
cise, according to the standard non-relativistic quantum-mechanical measurement theory the outcome 
statistics refers to the system state at a particular moment of time. In the non-relativistic case the 
information on the outcome of a certain measurement involving distant points (e.g. the measuring 
apparatus can "read off" information on a quantum state simultaneously in different spatial points) 
can be gathered instantly to an observer at a certain point as long as there are no restrictions on the 
speed of information transfer. 

Unlike the non-relativistic quantum mechanics, there is still no consistent measurement theory for 
the relativistic case. The instantaneous non-local measurements in the sense described above for the 
non-relativistic quantum mechanics seem to be impossible in the relativistic quantum theory. Even 
if the measuring apparatus performs simultaneous (in a certain reference frame) measurement of a 
quantum state in two different points xi and X2, the information on the obtained outcomes cannot 
be gathered by a single localized observer in a time interval shorter than t = |xi — X2|/2c. Therefore, 
non-local measurements require finite time which depends on the structure of the measured states. 

Thus, in the relativistic quantum field theory gathering information on the outcome of a non- 
local measurement requires a finite time. In addition, if the measuring apparatus has only access 
to a limited domain D of space, the measurement performed over a non-stationary state would only 
provide information on that state if its spatial supports has common points with D at the time of 
measurement. If the state support lies outside D at time to, the full information on the state employing 
the measurements restricted to D is only possible in time ti L/2c, where L is the size of the state 
support since the state cannot move into the domain D in less than ti because of the constraint on 
the maximum field propagation speed. 

Before describing the protocol, we shall first discuss the measurements it employs. In the rest of 
the paper we shall deal with the massless particles (photons). The four-dimensional vector-potential 
operators have the form [12] 

= / W;!? =f^l e*'«e„"(k)„± (k)-|=, (6) 

where kx = k^x^ — kx. The operators A^{x) are supposed to satisfy the Bose commutation relations 
[12] 

[Am{xi),A+{x2)]- = igmnDQ {xi - X2), (7) 

where g'^'^ is the metric tensor {g'^^ = —g^^ = —g^^ = —g^^ = 1), ^'o' is the negative-frequency 
commutator function for the massless field 

^o-(^) = -^7^ / dk5(P)e{-k^)e^>^' = 7^3 / 1^^"^^°'"^'^' 
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which is only different from zero and has a singularity on the light cone [12] 

D^{x) = ^e{x')5{X), X' = {xy - x^. (9) 

Further we put c = 1. The creation and annihilation operators a^(k) describe the photons of four 

types: two transverse, one longitudinal, and one temporal. The two latter types are non-physical and 
are only introduced to preserve the four-dimensional structure of the vector-potential. The commuta- 
tion relations are 

[a-(k),a+(k')]- = -5"'"<5(k-k'), ie"-e'') = S^,p, (a,/3 = 1,2,3), = 0, = A. 

When working with the four types of photons one should employ the indefinite metric. For our 
purposes it is sufficient to deal with a single sort of photons with a fixed helicity and we shall therefore 
work in the subspace of one-particle states equipped with a standard hermitian scalar product (for 
details see Ref.[12]). 

The one-photon states corresponding to the bit values and 1, respectively, IV'i) and \ip2), can be 
chosen in the form 

IV'1,2) = / V'i,2(k)a+(k,.)|0)-^ = J V.i,2(k)|k,.)-^, (k,.|k',.) =<^(k-kO, (10) 

where a'^(k, s) is the operator of creation of a photon with momentum k and helicity s. We assume 
that the state amplitudes have non-overlapping supports 

supp V'i(k) Pi supp V'2(k) = 0, J^j(k) = supp ^i(k). (11) 

Then the states iV'i) and \tp2) are orthogonal 

r,ik)M^)— = 0. (12) 

The measurement allowing to reliably distinguish between the two orthogonal states iV'i) and {^2) is 
given by the identity resolution 

r 

V^,+Vrp^+V^ = I, 1 = J \Ks){k,s\^, (13) 

ni,2 = f/ ^ ^^i,2(k)|k,.)^V/ {k',s\ri,2{^')^], r± = i-n,-r^,. 

The probabilities of different outcomes for the input state \tfji) are given by the relations 

P%,{Pfc,i} = Ti{\'Pi){i'i\P^.i} = 0, 

and similarly for the input state |V'2)- 

To illustrate the non-local nature of the measurement (13) more clearly, let us consider an auxiliary 
measurement in the position representation which transforms to the measurement allowing reliable 
distinguishing of the two states when the involved spatial domain is extended to the entire space. 

Consider first an auxiliary measurement which allows to reliably distinguish between any two 
states with non-overlapping supports rather than a particular pair of states. This measurement is 
very similar to the measurement (13): 

r (Tlr 

Vi+V2 + V± = I, 1 = J \k,s){k,s\^, (15) 
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rent outcomes for the input state jV'i) are 

r rl'k 

Fn{r,} = Tr{|V'i)(V'i|Pi} = / \M^)\':^ = 1, (16) 



dk 

\k,s}{k,s\ 

1.2 (k) 

The probabiUties of different outcomes for the input state IV'i) are 

dk 

/ni(k) 

Pri{P2,±} = 'IV{IV'i)(V'i|^2,±} = 0, 

and similarly for the input state \il^2)- 

According to the quantum-mechanical measurement theory, any measurement is described by the 
positive identity resolution on the Hilbert space of the system states, or, to be more precise, by 
the positive operator- valued measure M (on a certain measurable outcome space U) satisfying the 
conditions [13] 

1) M(0) = 0, M{U) = I, M{Ui) > 0, 

2) M{Ui)<M(U2), U1QU2, (17) 

3) M{\JUi) = ^iM{Ui), Uif]Uj = $. 

i 

Wc shall choose a three-element discrete space whose points are labeled by the symbols {1,2, _L} as 
the space of outcomes: 

Mi2=/ dxf / e'^(^-*°)|k,s)-^V/ e-^^'(*-^o)(k',s|^iLV (18) 

where 

X = {-X.: X G (— oo,cx))}, 

/C = {k : k G (—00, 00)}. 

The positive operator-valued measure Mj defines an identity resolution on the space of outcomes 
{1,2,±}: 

dk 



J^\k,s){k,s\^ = L 



First of all, it is seen from (19,20) that when the spatial domain 0,(x.) is extended to the entire 
position space X the measurement transforms to the orthogonal identity resolution (15) which allows 
to reliably distinguish between the states with non-overlapping supports. 

For example, the probability of obtaining the outcome 1 for the input state [-^i) is 



Pri{Mi} = TV{|Vi)(V'i|Mi} = 

= -(27r)6 / dx I M-i^) f D^{x - xo)D+{xo - x). 
Jn(x) ox 

Since the amplitude ipi{k) has a finite support, i.e. it vanishes outside the domain rii(k), the domain 
of integration over k, k' in Eq.(21) can be extended to the entire space /C. We assume the amplitude 
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■01 (k) to be a sufficiently smooth function to allow the substitution of the argument k by id/dx 
followed by its extraction outside the integral sign over k. Further, taking into account the definition 
of function Dq[x) (8), one obtains the final expression. Remember also that Dq{x) = —Dq(—x). The 
probability of obtaining outcome 2 for the input state iV'i) is identically equal to zero (and similarly 
for the outcome 2 with the input state \i>2))' 

Pri{M2} = TV{|Vi)(V'i|M2}= (22) 

since the amplitudes ipi(k) and V'2(k) possess non-overlapping supports. 

Finally, the probability of obtaining the outcome ± for the input state (and, similarly, for 

IV'2)) is 

Pri{Mi} = IV{|V'i)(V'i|M^} = 



A'\f2(x) 



.x( /_ ,.,e^^(-o)^*(k)|i) e--(-o)^^(k')^) = (23) 




-{27rf f dx I M-i^) I' D^ix - xo)D+{xo - x). 
Jxxnu) ax 



d 

dx I ipi(—t 

/Af\n(x) 

The measurement (19-23) has a simple meaning. The equation (21) describes the probability of 
detection in the spatial domain r2(x) of the state whose support lies in rJi(k) (and similarly for \ip2))- 

Reliable detection of the states whose support lies in Oi(k) requires the access to the entire spatial 
domain where the state is present; it is seen from Eq.(21) that contribution to the probability is 
only given by the causally related points {{x — xq)^ = 0, |xo — x| = c|to — *1) since the commutator 
functions D^{x — xq) are only different from zero on the light cone. In spite of the fact that the 
commutation functions in (21,22) both have a singularity on the light cone, their product always 
exists as a distribution since the Fourier transforms of ZJ^-functions have their supports in the front 
part of the light cone (for details see e.g. [14]). 

Equation (23) yields the probability of detection of a state with the support in rii(k) (and similarly 
for IV'2)) in the rest part of the space A'\Q(x) due to the "tails" of the state which do not "fit" into 
the spatial domain J7(x). When the accessible domain fi(x) is extended to the extent that the entire 
state l^i) can "fit" into it, the measurement discussed transforms to the measurement corresponding 
to the orthogonal projectors (15) which allows to reliably (with unit probability) distinguish between 
the two states, the probability of detection of the "tails" ± tending to zero. 

Eq.(21) is especially transparent for the state which is strongly localized in the position space. In 
that case the state amplitude in the momentum space is strongly delocalizcd (in the limit |0i(k)p) 
const the support ili(k) — > /C and, accordingly, \ijj{—id/d:x.)\'^ does not depend on x). Eq. (21) 
becomes 



Pri{Afi} = (iTrf / dx i Df,ix - xq) \' . (24) 

If we now remember that the function —iDQ{x — xq) describes the amplitude of the propagation of a 
one-particle field state created at a point xq to the point x 

(0|^r(x)V'i+(xo)|0) = -iD^ix - xo), xo > xl (25) 

then Eq.(21) yields the probability of detection of the one-particle field state with the support in 
rii(k) — /C in the spatial domain 0(x). It is seen from Eq.(24), that if the integration domain ri(x) 
does not include the points where the one-particle state was created xq the detection probability is 
zero. For reliable detection of a strongly spatially localized state the spatial domain should be chosen 
arbitrarily small, i7(x) — 0. The field can "fill in" this domain arbitrarily fast (naturally, excluding 
the time-of-flight from the creation point xq to J7(x)). 
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On the contrary, if the state is not strongly locahzed in space (so that 1-01(14)1^ 7^ const and, 
accordingly, \'>Jji{—id/dx.)\'^ ^ const), the contributions are given by all the points of the domain r2(x). 
The stronger the state is localized in the k-space, the stronger it is delocalized in the position space 
and the larger domain f2(x) is required for a reliable (with unit probability) detection of the state. 
The field cannot "fill in" that domain in time less than t L(r2(x))/c, where L is the characteristic 
domain size. 

It will be important for the bit commitment protocol that the detection probability grows with 
time (as the field fills the domain accessible to the measurement) and finally after the time T elapses 
(this time depends on the structure of the particular state) the states become reliably distinguishable 
due to their orthogonality. During the time interval < t < T the states are effectively non-orthogonal 
(non-distinguishable reliably). Choosing the supports r2i^2(k) of the states more and localized the time 
interval T can be made arbitrarily long. 

Because of the symmetry between and 1 it is convenient to choose the states in such a way that 
the domain J7(x) be the same for them (the correct identification probabilities as functions of time 
will then be identical for and 1). For the photons this can always be done by choosing, for example, 
a pair of narrow-band state with the same frequency width and different central frequencies. 

It should be emphasized that Eqs. (21-23) are statistical in nature. If the domain accessible in the 
measurement procedure is small, or equivalently, the state should be identified in a short time, the 
probability of the correct answer is small, since most of the outcomes will occur in the channel M± 
independently of the income state. The probabilities of the outcomes 1 and 2 are small due to the 
smallness of the domain accessible to the detection procedure. However, firing of the detector in the 
channel Mi or M2 is sufficient to correctly identify the state, the problem being the low probability 
of the corresponding events. 

It is also easy to write down the measurement involving a finite spatial domain and allowing to 
reliably distinguish between a pair of particular orthogonal states l-^i) and \tp2) (rather than the states 
with non-overlapping supports) when the spatial domain 0(x) is extended to the entire position space: 

Mi,2 = (26) 

M^ = I-Mi-M2. (27) 

When the accessible domain is extended to the entire space (i^(x) — > X) this measurements transforms 
to the orthogonal projectors given by Eq.(13). 

3 Example of a one-dimensional measurement 

To get a qualitative picture and obtain more accurate estimates, we shall consider a model one- 
dimensional situation since the three-dimensional case requires the specification of the geometry of 
spatial domains. In addition, the experimental realization usually employ the optical fiber (which 
is a one-dimensional system) as the quantum channel. Similar model one-dimensional schemes are 
frequently used in quantum optics. 

Suppose we have a pair of orthogonal single-photon packets 

roo 

IV'1,2) = / Mk)\k)dk, pi,2 = 1^-1,2) (V'1,2 1, k>0, {k\k') = S{k - k'), (28) 
Jo 

where \k) = a'^\0) is the single-photon monochromatic Fock state (we consider the particles moving 
in only one direction) . In addition, in the one-dimensional case, A;° = A; (c = 1 is the velocity of light) . 
The states have non-overlapping supports with the same bandwidth 

^1,2 = supp 0^1,2 = {fc : ke{-A/2 + h^2,ki,2 + A/2)}, E = {k : A;G[0,oo)}, (29) 
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h-k2>A, [ |l/;i,2(fc)|'d/c = 1, 



'Si, 2 

The states with the non-overlapping supports are orthogonal 

(Vi|V2)= / ri{k)Mk)dk = 0. (30) 
Jo 

The measurement allowing to reliably distinguish between the states (28) is given by the identity 
resolution similar to Eq.(15) 

POO r r 

Vi+V2 + V± = I, 1= \k){k\dk, Vi,2= \k){k\dk, V±= \k){k\dk. (31) 

Jo JEx,2 JE\{Ei\jE2) 

The identity resolution (31) does not involve the position and time parameter indicating that it is 
implicitly assumed that the spatial domain accessible to the measurement procedure is a; G (—00,00). 

In the one-dimensional case the measurement Mj similar to (19,20) has the same form, the only 
difference being the replacement of the three-dimensional domain f2(x) by the one-dimensional which 
for brevity will be denoted a,s X = {x : x £ {—X,X)}. The one-dimensional case is especially 
transparent, since the time parameter and position appear in the combination x — ct which is actually 
related to the properties of the fundamental solution of the one-dimensional wave equation which is 
known to have the form £{x, t) =oc 6{ct— \x\) unlike the three-dimensional case 

|xp)) [15]. Therefore, in the one-dimensional case expansion of the spatial domain X accessible in the 
measurement can be effectively obtained (for fixed X) by increasing the accessible time interval T. 
Taking the above consideration in the account we shall below speak for brevity that the measurements 
are performed in the accessible time window (— T, T). 

The probability of occurrence of the outcome 1 for the input density matrix pi in the one- 
dimensional case is conveniently written (first performing integration over x) as 

Pri{Mi} = TV{piMi}= / / ^i*(fc)^i(A:0 ''"if ' ^'^'^^ dkdk' , T = ct - \X\. (32) 

Jei Jei [k — k') 

Eq.(32) yields the probability of detection of the systems whose density matrix has the support in 
El during the time window {—T,T). 

If the time window during which the measurements are allowed is short (TA <C 1), Eq.(32) yields 

Pri{ Ml} « TA < 1 fsi 0, (33) 

i.e. the detection probability is proportional to the time window duration. For a long time window 
(TA » 1) one has 

1 sin f 

Pri{ Ml} « - / —^dC = 1 - cos (TA)/TA « 1, TA > 1. (34) 

TT J-T C, 

If the input state is p2, the probability of obtaining outcome 2 is zero independently of the time 
window duration T (and similarly for pi and outcome 2): 

Pr2{Mi} = Tr{p2Mi} = Pri{M2} = Tr{piM2} = 0. (35) 

Eq.(32) can be rewritten in a more usual form as 

/T roo 
\Mr)\''dT, Mr) = / Mk)e-'''^dk, (36) 
-T Jo 

which is consistent with the intuitive classical concepts. If the function is localized in the frequency 
representation, it is delocalized in the temporal representation, so that reliable signal detection requires 
a long time window which can fully "cover" iP{t). 
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Here one reservation is in place. If we are given a classical state, i.e. a classical function tp{x) 
with the beforehand unknown support in the ^-representation (supp tp{k) = A), the support can only 
be found if one finds the values of the function in the spatial domain whose size is not less than 
L-r 1/A. On the other hand, if one has to distinguish between the two classical functions ^i(A;) and 
■02 (^) with non-overlapping supports it is sufficient to know the function values in a single point x 
where ipi{x) ^ ^2ix). Therefore, reliable distinguishing between the two classical functions requires 
the knowledge of the function values in a single point where these values are different. 

To reliably distinguish between the two orthogonal quantum states [ipi) and with unit prob- 
ability one requires the access to the entire spatial domain where these states are different from zero 
(we assume that both states are different from zero in the same domain). 

For a short time window (T <C 1/A, where A is the bandwidth) the detection probability is small 
to the extent TA <^ 1. If the detection occurs in channels 1 or 2, this is sufficient to reliably distinguish 
between the states lipi) and |'02)- However, for a short time window dominating for both input states 
\^pl) and IV'2) will be the detection events in channel _L, i.e. the states will be indistinguishable with 
the probability close to 1 (effectively non-orthogonal). 

The outcomes in channel _L will occur in the time window (—00,00) due to the states whose 
supports do not lie in Ei or E2 and, in addition, in the time intervals (—00, — T) and (T, 00) due to 
the "tails" of the states with the supports in £^1^2 which were not detected in the channels 1,2 in the 
time window (— T, T). 

The detection probability of pi 2 in the channel _L is 

Pri,2{±} = /^^ ^ /^^ ^ [S{k - k') - r,,2mi,2{k')dkdk' . (37) 

For TA S> 1 (long time window) we have 

Pri,2{±} ~ cos {TA)/TA 0, (38) 
while for TA <C 1 (short time window) 

Pri,2{±} ~ sin (TA) /TA ^ 1. (39) 

Eqs. (32-39) actually mean that if one of the states pi or p2 is given and one should identify which 
state is actually given during the time interval T then for T <C 1/A the probability of the correct 
identification ~ TA <C 1 (accordingly, the wrong answer probability is p_ ~ 1 — TA ~ 1), since 
the detection probability in the time interval T is small. On the other hand if the measurements are 
allowed to be performed in th long time window (TA » 1), the probability of the correct answer 
~ 1 — 1/TA ~ 1 so that the states are reliably distinguishable. 

For a short time window the sates are effectively non-orthogonal (they cannot be distinguished 
reliably). The effective angle a between the states pi and p2 in the time interval {—T,T) is small 

(V'l I ^^2) ~ cos a 1 - TA, a TA < 1. (40) 

4 Relativistic quantum bit commitment protocol 

Let us now describe the bit commitment protocol. The two parties agree in advance on the states {tpi) 
and \ip2) corresponding to and 1 as well as on the number N of quantum systems sent by user A to B. 
It is always possible to choose a pair of orthogonal states so that their spatial extent strongly exceeds 
the channel length and their fall-off at the infinity insures almost reliable identification after the time 
T elapses. In the case of photons one can choose two states with sufficiently narrow energy spectra 
so that their effective extent L ~ c/ Alo (Alo is the energy spectrum width) substantially exceeds the 
communication channel length Lch, In that case the channel length can effectively assumed to be zero. 
Formally that means that the two parties A and B can only control the neighbourhoods of the points 
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xa and x^j and do not control the space outside these neighbourhoods. In other words, outside the 
neighbourlioods of xa and xb both parties are allowed to do anything which does not contradict the 
laws of relativistic quantum mechanics. 

The user A chooses his bit a (0 or 1), which is the parity bit of N quantum states (a = ai0a2 0. . .© 
qn)- Then at time t = the user A sends to B all N states simultaneously. To be more precise, user 
A turns on N sources producing the states which arc allowed to propagate into the communication 
channel as long as they are being formed. Since the states and \ip2) arc generally non-stationary, 
fixing the time moment t = allows user B to "tune" the measurement (13) by choosing appropriate 
phase shifts for any spatial domain reached by the field as it is propagating in the communication 
channel. User B performs measurements (13) separately on each state. Because of the orthogonality, 
the states become distinguishable by the time T when they are first fully accessible. In the time 
interval < t < T the states are not fully accessible (effectively non-orthogonal) and therefore are 
not reliably distinguishable. The probability of correct identification of the states is an increasing 
function of time {p{t = 0) = and p{t = T) = 1), the specific form of p{t) depending on the structure 
of the particular states used and being irrelevant for our analysis. For individual measurements the 
probability of the correct identification of the parity bit P+(t) = {t) <C 1 as long as p{t) <C 1. 
For collective measurements, when the measurements are performed over all N states as a whole the 
probability of the correct parity bit identification is p<^^''-(''^'t (^f^ = \Jp^ it) ^ 1 [16] and can also be 
made arbitrarily small by appropriate choice of the states used. The states can always be chosen in 
such a way that for an arbitrarily small quantity (5 <C 1 specified beforehand and arbitrarily large time 
tc {tc is the time of secure storage of the secret bit chosen by user A) the probability p^l^^<*{t'^ of the 
correct identification of the parity bit during time t < tc is arbitrarily small. This can be achieved by 
increasing the effective extent of the states (reducing the spectrum width). 

The above discussion concerns the case where the user B obtains the information on the states only 
from the quantum-mechanical measurements. The mentioned probabilities p{t) actually represent the 
probabilities of the state detection (firing of a classical apparatus) which for times t < T is less than 
1 because the entire state is not accessible for the measurement. However, if the detection did take 
place, the state can be identified by the obtained measurement outcome. Therefore, as long as the 
probability of the detection itself pi{t) < 1/2, the user B can even perform no measurements simply 
guessing the states sent in each communication channel. However, for the times when Piit) > 1/2 the 
measurements provide more information than simple guessing without performing any measurements. 
For t ^ T the measurements provide almost reliable information on the states. 

Therefor, the probability p**°^^(i) of secure storage of the secrete bit chosen by user A is a de- 
creasing function of time {p^i°^^{t = 0) = 1 and p^i°^^{t = T) = 0). 

After the quantum part of the protocol is completed at t > T, when user B already has the 
full access to the states and can reliably identify them, user A discloses through a classical channel 
which states he sent through each of N quantum channels. Any inconsistency between the classical 
information and the measurement result in at least one channel aborts the protocol. The necessity 
of conveying the classical information by user A after the quantum-mechanical measurements and 
the individual reliable distinguishability (orthogonality) of the states eliminates the possibility of 
cheating. For example, user A cannot send the mixed states like p = + |V'2)(V'2|, since for 

large N this would result in the discrepancy between the classical information and the outcomes of 
quantum measurements. Neither can he send any other states instead of and \1jj2) because of 
their orthogonality, i.e. reliable distinguishability. Any different states would yield for large N wrong 
outcomes if the measurement Vi^2,± is used. The constraints on the maximum field state propagation 
velocity does not allow the user A to delay sending his states to user B since the measurement (13) is 
"tuned" to precisely the states and |^/;2) so that the delayed states would produce wrong outcomes. 
Formally, the delay can be described as a translation in the space-time which results in an additional 
phase factor e^^^° under the integral sign in (10). The "shifted" state, e.g. jV'i), will not yield the 
outcome 1 with the unit probability. 

In the non-relativistic case the user A can employ the EPR pair which allows him to delay his 
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choice of the secret bit until the measurement performed by user B [5,6]. In the relativistic case 
the EPR-attack does not work because of the constraint on the maximum speed of the field state 
propagation. In spite of the fact that the EPR correlations are also preserved in the relativistic 
case for the measurements performed on the entangled two-particle states of the field at the points 
separated by the space-like interval [17], the field cannot propagate from the EPR-source faster than 
light. Therefore, in contrast to the non-relativistic quantum mechanics, employment by user A of an 
EPR-pair to delay his choice until the second stage of the protocol does not work. 

It should be noted once again that it is important for the protocol that the orthogonal states 
have quantum nature, so that their reliable distinguishability (with unit probability) requires a finite 
spatial domain. Two classical states (functions) can be reliably distinguished by their values at a 
single suitably chosen point. 

The time interval T required for a reliable distinguishability of the states, i.e. the time of secure 
storage of the secrete bit, is determined by the spectrum bandwidth A|k| ~ Atj/c of the photons used 
in the protocol and is estimated as T ~ l/Aw. Note that although there are no any fundamental 
constraints on making the photon bandwidth arbitrarily small, this problem is technically very difficult. 

5 Conclusions 

We conclude with the following remark. The possibility of the state identification with the unit 
probability during time interval T depends on the existence for a particular type of particles of the 
states with finite spatial support. For the photons only the states with the exponentially localized 
energy and detection rate are known at present [18]. The latter formally means that the correct 
identification with unit probability is only possible for an infinite time interval. This consideration 
is not too restrictive fro the protocol since the time interval can be chosen to be sufficiently long to 
ensure the distinguishability probability exponentially close to unit for two orthogonal states. 

The experimental realization is rather simple (at least in principle). It is sufficient to have N 
broadband sources. The term "broad band" here means that when turned on these sources produce 
the states localized in space and time, that is at the time moment to one can prepare the signals with 
wide frequency spectrum. Before being allowed in the communication channel, these states should pass 
the narrow-band filters and attenuators to reach the one-photon level. Passage through the narrow- 
band filter requires either long time or large space. The detection is performed by the narrow-band 
detectors. 

This work was supported by the Russian Foundation for Basic Research (project No 99-02-18127), 
grant No 02. 04. 5. 2. 40. T. 50 within the framework of the Program "Advanced devices and technolo- 
gies in micro- and nanoelectronics" and by the Program "Physics of quantum and wave processes" 
(subprogram "Quantum computing"). 
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